EUTour2013 Cambridge Agenda

OWASP Europe Tour - Cambridge 2013

Monday 13th May(Conference)

DESCRIPTION

OWASP Europe TOUR, is an event across the European region that promotes awareness about application security, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.

Apart from OWASP's Top 10, most OWASP Projects are not widely used and understood. In most cases this is not due to lack of quality and usefulness of those Document & Tool projects, but due to a lack of understanding of where they fit in an Enterprise's security ecosystem or in the Web Application Development Life-cycle.

This event aims to change that by providing a selection of mature and enterprise ready projects together with practical examples of how to use them.

OWASP MEMBERSHIP

During the OWASP Europe Tour you could become a member and support our mission.

Following a systematic study of the costs of cybercrime, in response to a request from the UK Ministry of Defence following scepticism that previous studies had hyped the problem, each of the main categories of cybercrime we set out what is and is not known of the direct costs, indirect costs and defence costs { both to the UK and to the world as a whole. We distinguish carefully between traditional crimes that are now `cyber' because they are conducted online (such as tax and welfare fraud); transitional crimes whose modus operandi has changed substantially as a result of the move online (such as credit card fraud); new crimes that owe their existence to the Internet; and what we might call platform crimes such as the provision of botnets which facilitate other crimes rather than being used to extract money from victims

directly.

12:45 (45 mins)

Three Legged Cybercrime Investigation and its Implications

DI Stewart Garrick (Metropolitan Police ECrime Unit)

DI Stewart Garrick has over 27 years experience in the Metropolitan Police Service, 22 years as a detective and 10 years as a Detective Inspector. His career has been spent primarily on major crime units engaged on both proactive and reactive investigations, including 5 years investigating murders, 3 years on the Homicide Task Force (a proactive unit targeting those who would commit murder) and 5 years managing covert operations against organised crime. In March 2011 he joined Scotland Yard's Police Central eCrime Unit. He has witnessed the PCeU's growth from 40 officers to over 100 and has managed several high profile investigations. He has recently taken charge of the unit's cadre of police and civilian forensic examiners who are integrated into the unit's dynamic investigative model. He has this year completed an MSc in Countering Organised Crime and Terrorism at UCL, with a dissertation examining the emergence of radicalising settings based on Situational Action Theory.

13:30 (45 mins)

OWASP Mobile Top 10

Justin Clarke - London OWASP Chapter Leader

The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications. Through the project, our goal is to classify mobile security risks and provide developmental controls to reduce their impact or likelihood of exploitation.

As part of the overall Mobile Project , the Top 10 Mobile Risks include

The premise behind this talk is to challenge both the technical controls we recommend to developers and also out actual approach to testing. This talk is sure to challenge the status quo of web security today.

"Insanity is doing the same thing over and over and expecting different results." - Albert Einstein

We continue to rely on a “pentest” to secure our applications.
Why do we think it is acceptable to perform a time-limited test of an application to help ensure security when a determined attacker may spend 10-100 times longer attempting to find a suitable vulnerability?
Our testing methodologies are non-consistent and rely on the individual and the tools they use.
Currently we treat vulnerabilities like XSS and SQLI as different issues but the root causes it the same. – it’s all code injection theory!! Why do we do this and make security bugs over complex?

Why are we still happy with “Testing security out” rather than the more superior “building security in”?

15:45 (45 mins)

Tricolour Alphanumercial Spaghetti

Colin Watson - OWASP Project Leader

Do you know your "A, B, Cs" from your "1, 2, 3s"?

Is "red" much worse than "orange", and why is "yellow" used instead of "green"?

Just what is a "critical" vulnerability? Is "critical" the same as "very high"?

Does a "tick" mean you passed? Are you using CWE and CVSS? Is a "medium" network vulnerability as dangerous as a "medium" application vulnerability? Can CWSS help?

What is FIPS PUB 199? Does risk ranking equate to prioritisation? What is "one" vulnerability?

Are you drowning in a mess of unrelated, classifications, terminology and abbreviations? If you are a security verifier and want to know more about ranking your findings more meaningfully, or receive test reports and want to better understand the results, or are just new to ranking weaknesses/vulnerabilities and want an overview, come along to this presentation. It will also explain why the unranked information-only ("grey" or "blue"?) findings might contain some of the best value information.

16:30 (45 mins)

Secure Coding, some simple steps help.

Steven van der Baan - OWASP Cambridge

Secure coding is often perceived as difficult and complex.

While it is true that 'good security' should be embedded into the design, there are a couple of steps a developer can take which lead to a
more secure application.
In this presentation we will go to the basics of secure application
development and demonstrate these principles which help you build security into your application.